CVSS: 9.8EPSS: 38%CPEs: 7EXPL: 0CVE-2018-1000517 – Ubuntu Security Notice USN-3935-1
https://notcve.org/view.php?id=CVE-2018-1000517
26 Jun 2018 — BusyBox project BusyBox wget version prior to commit 8e2174e9bd836e53c8b9c6e00d1bc6e2a718686e contains a Buffer Overflow vulnerability in Busybox wget that can result in heap buffer overflow. This attack appear to be exploitable via network connectivity. This vulnerability appears to have been fixed in after commit 8e2174e9bd836e53c8b9c6e00d1bc6e2a718686e. BusyBox wget, de BusyBox project , en versiones anteriores al commit con ID 8e2174e9bd836e53c8b9c6e00d1bc6e2a718686e, contiene una vulnerabilidad de desb... • https://git.busybox.net/busybox/commit/?id=8e2174e9bd836e53c8b9c6e00d1bc6e2a718686e • CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') •
CVSS: 8.8EPSS: 1%CPEs: 189EXPL: 16CVE-2017-16544 – Nexans FTTO GigaSwitch Outdated Components / Hardcoded Backdoor
https://notcve.org/view.php?id=CVE-2017-16544
20 Nov 2017 — In the add_match function in libbb/lineedit.c in BusyBox through 1.27.2, the tab autocomplete feature of the shell, used to get a list of filenames in a directory, does not sanitize filenames and results in executing any escape sequence in the terminal. This could potentially result in code execution, arbitrary file writes, or other attacks. En la función add_match en libbb/lineedit.c en BusyBox hasta la versión 1.27.2, la característica de autocompletar pestañas del shell, empleada para obtener una lista d... • https://packetstorm.news/files/id/167552 • CWE-94: Improper Control of Generation of Code ('Code Injection') •
CVSS: 7.5EPSS: 5%CPEs: 7EXPL: 5CVE-2011-5325 – Ubuntu Security Notice USN-3935-1
https://notcve.org/view.php?id=CVE-2011-5325
07 Aug 2017 — Directory traversal vulnerability in the BusyBox implementation of tar before 1.22.0 v5 allows remote attackers to point to files outside the current working directory via a symlink. Una vulnerabilidad de salto de directorio en la implementación de tar en BusyBox en versiones anteriores a 1.22.0 v5 permite que atacantes remotos apunten a archivos situados fuera del actual directorio de trabajo a través de un symlink. Tyler Hicks discovered that BusyBox incorrectly handled symlinks inside tar archives. If a ... • https://packetstorm.news/files/id/153278 • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •
CVSS: 7.8EPSS: 4%CPEs: 1EXPL: 2CVE-2016-6301 – Cisco Device Hardcoded Credentials / GNU glibc / BusyBox
https://notcve.org/view.php?id=CVE-2016-6301
09 Dec 2016 — The recv_and_process_client_pkt function in networking/ntpd.c in busybox allows remote attackers to cause a denial of service (CPU and bandwidth consumption) via a forged NTP packet, which triggers a communication loop. La función recv_and_process_client_pkt en networking/ntpd.c en busybox permite a atacantes remotos provocar una denegación de servicio (consumo de CPU y ancho de banda) a través de un paquete NTP falsificado, lo que desencadena un bucle de comunicación. Many Cisco devices such as Cisco RV340... • https://packetstorm.news/files/id/154361 • CWE-399: Resource Management Errors •
CVSS: 7.5EPSS: 3%CPEs: 7EXPL: 9CVE-2016-2147 – Cisco Device Hardcoded Credentials / GNU glibc / BusyBox
https://notcve.org/view.php?id=CVE-2016-2147
05 Dec 2016 — Integer overflow in the DHCP client (udhcpc) in BusyBox before 1.25.0 allows remote attackers to cause a denial of service (crash) via a malformed RFC1035-encoded domain name, which triggers an out-of-bounds heap write. Desbordamiento de entero en el cliente DHCP (udhcpc) en BusyBox en versiones anteriores a 1.25.0 permite a atacantes remotos provocar una denegación de servicio (caída) a través de un nombre de dominio codificado RFC1035 mal formado, lo que desencadena una escritura de memoria dinámica fuera... • https://packetstorm.news/files/id/154361 • CWE-190: Integer Overflow or Wraparound •
CVSS: 9.8EPSS: 16%CPEs: 7EXPL: 9CVE-2016-2148 – Cisco Device Hardcoded Credentials / GNU glibc / BusyBox
https://notcve.org/view.php?id=CVE-2016-2148
05 Dec 2016 — Heap-based buffer overflow in the DHCP client (udhcpc) in BusyBox before 1.25.0 allows remote attackers to have unspecified impact via vectors involving OPTION_6RD parsing. Desbordamiento de búfer basado en memoria dinámica en el cliente DHCP (udhcpc) en BusyBox en versiones anteriores a 1.25.0 permite a atacantes remotos tener un impacto no especificado a través de vectores que implican el análisis de OPTION_6RD. Tyler Hicks discovered that BusyBox incorrectly handled symlinks inside tar archives. If a use... • https://packetstorm.news/files/id/154361 • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 5.5EPSS: 0%CPEs: 1EXPL: 0CVE-2014-9645 – Ubuntu Security Notice USN-3935-1
https://notcve.org/view.php?id=CVE-2014-9645
09 Feb 2015 — The add_probe function in modutils/modprobe.c in BusyBox before 1.23.0 allows local users to bypass intended restrictions on loading kernel modules via a / (slash) character in a module name, as demonstrated by an "ifconfig /usbserial up" command or a "mount -t /snd_pcm none /" command. La función add_probe en modutils/modprobe.c en BusyBox en versiones anteriores a 1.23.0 permite a usuarios locales eludir las restricciones previstas al cargar los módulos del kernel a través de un caracter / (barra oblicua)... • http://git.busybox.net/busybox/commit/?id=4e314faa0aecb66717418e9a47a4451aec59262b • CWE-20: Improper Input Validation •
CVSS: 9.1EPSS: 0%CPEs: 101EXPL: 2CVE-2013-1813 – busybox: insecure directory permissions in /dev
https://notcve.org/view.php?id=CVE-2013-1813
21 Nov 2013 — util-linux/mdev.c in BusyBox before 1.21.0 uses 0777 permissions for parent directories when creating nested directories under /dev/, which allows local users to have unknown impact and attack vectors. util-linux/mdev.c en BusyBox anterior a la versión 1.21.0 utiliza permisos 0777 en directorios padre al crear directorios anidados bajo /dev/, lo que permite a usuarios locales tener un impacto y vectores de ataques desconocidos. BusyBox provides a single binary that includes versions of a large number of sys... • https://packetstorm.news/files/id/153278 • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 9.8EPSS: 1%CPEs: 92EXPL: 1CVE-2011-2716 – busybox: udhcpc insufficient checking of DHCP options
https://notcve.org/view.php?id=CVE-2011-2716
03 Jul 2012 — The DHCP client (udhcpc) in BusyBox before 1.20.0 allows remote DHCP servers to execute arbitrary commands via shell metacharacters in the (1) HOST_NAME, (2) DOMAIN_NAME, (3) NIS_DOMAIN, and (4) TFTP_SERVER_NAME host name options. El cliente DHCP (udhcpc) en BusyBox anterior a v1.20.0 permite a servidores DHCP remotos ejecutar comandos arbitrarios mediante una shell de metacaracteres en el (1) HOST_NAME, (2) DOMAIN_NAME, (3) NIS_DOMAIN, y (4) las opciones de nombre de host TFTP_SERVER_NAME The industrial ma... • https://packetstorm.news/files/id/153278 • CWE-20: Improper Input Validation •